# Ghost v5.130.6 — Release & Upgrade Intelligence
- **Product:** Ghost (https://ghost.org)
- **Version:** v5.130.6
- **Released:** Jan 08, 2026
- **Impact Score:** 5/10
- **Breaking Changes:** Not verified
- **Canonical Analysis:** https://changelogs.us/ghost/updates/v5.130.6/

## Executive Summary (TL;DR)
Ghost v5.130.6. Source highlight: 🔒 Fixed staff token authorization bypass via trailing slash mismatch (#25805) - Michael Barrett

## Bug Fixes
- 🔒 Fixed staff token authorization bypass via trailing slash mismatch (#25805) - Michael Barrett
- 🔒 Fixed potential SSRF via media inliner (#25807) - Michael Barrett
- 🔒 Fixed SQL injection vulnerability in click event query (#25804) - Michael Barrett
- 🔒 Fixed ability to bypass Staff User 2FA flow (#25806) - Michael Barrett